Just XSS hunter guy
Joined October 2014
- Tweets80
- Following83
- Followers417
- Likes825
RootEval retweeted
New DOJO challenge #24 - Cipher
Top 3 reports win a swag pack! 🎁
Submit your solution before 17/06/2023 🗓️
Check it out here : yeswehack.com/programs/dojo
#YesWeRHackers #BugBounty
ALT YesWeHack DOJO challenge Cipher
RootEval retweeted
How I found two XSS vulnerabilities in @mikrotik_com WebFig medium.com/@ivars.vids/two-x… #importantspoofing
RootEval retweeted
We are publishing the research of Copy&Paste issues in browsers by @SecurityMB. Over $30k in bounties for bugs in Chromium, Firefox, Safari, Google Docs, Gmail, TinyMCE, CKEditor, and others. Includes also 0-day in Froala.
research.securitum.com/the-c…
RootEval retweeted
New write-up
The Tangled Browsers: Beyond XSS (Part 1)
blog.s1r1us.ninja/CTF/tangle…
RootEval retweeted
Do you check for insecure deserialization bugs in Java web applications? There are plenty types of vulnerabilities of this kind.
Check this awesome cheat sheet by @antyurin :
github.com/GrrrDog/Java-Dese…
#BugBountyTip
RootEval retweeted
Do you need a pentest if your website is protected with a WAF? See for yourself: blog.deteact.com/bitrix-waf-…
RootEval retweeted
24 hours in, 18 valid submissions and 5 tips so far, covering 3 (!) different solutions from @terjanq, @D1r3Wolf_, @RootEval, @sakiirsecurity, @S1r1u5_, @p4fg, @nytr0gen_, @smaury92, @sud0_u53r, @_zulln, @krial057, @honoki, @KarimPwnz, @_0xUKN, @insertScript, and others!👏👏👏
CHALLENGE: Find the XSS in our #EasterChallenge and WIN a @Burp_Suite Pro License! We'll tweet a tip for every 100 likes! ❤️👇#HackWithIntigriti
challenge.intigriti.io
RootEval retweeted
Normally I would have just written a small blogpost but I give it a try: My first challenge - it doesn't look fancy^^ gonococcic-breath.000webhost…
RootEval retweeted
1st solved by @RootEval, congrats!
A free copy of my #XSS #CheatSheet 2020 Edition to the 1st one to mail me the solution.
If you already have it (legally) you will get a 3-month #KNOXSS Pro Plan!
brutelogic.com.br/lab/ent.ph…
RootEval retweeted
My "simple" XSS challenge is over! Once again congratz to @shafigullin @SecurityMB @BenHayak @element14_23 and @insertScript for solving it! But also to everyone else that tried their best.
Have you found all 11 vulnerabilities? 💪
medium.com/@terjanq/clobberi…
RootEval retweeted
I created a simple XSS challenge. Give it a shot:
sandbox.ahussam.me/challenge…
@XssPayloads
RootEval retweeted
WE HAVE 3 WINNERS!
Only 3 people have managed to solve all 10 levels of the #XSS #Challenge. Thank you @RootEval, @haqpl & @kolokokop - all of you had creative solutions, well done! You guys truly master #XSS. Thx also to the beta testers and @ObscurityApp (challenge creator).
Can you beat all 10 levels..?
#XSS #WAF #FilterEvasion #Challenge, from Beginner => Hard, pure XSS, no fantasy vectors. Will post first 7 solvers on my twitter. The challenge starts at login (no-xss), good luck. #Hacking #HackIt #CTF u.nu/hackit CodedBy: @ObscurityApp
RootEval retweeted
[JS Code-Golf Tip]
demo.innerHTML="click".link("attacker.com");
is as same as doing
document.getElementById("demo") = "<a href=attacker.com>click</a>"
I might write an article about shortening JS code but I don't have enough original content, let's see.
RootEval retweeted
So the writeup of my latest DOMPurify bypass has been published!
The evil was in </p> or </br>
research.securitum.com/dompu…
We have published a writeup of latest DOMPurify bypass with mutation XSS
research.securitum.com/dompu…